What an adversarial review found in our own AI governance
MachinaOS 1.1 is out. The headline additions are the two things organisations ask about first — single sign-on and audit export to the SIEM they already run — but the part worth writing about is how the rest of the release came to exist.
Rather than moving straight from 1.0 to new features, we spent a cycle attacking our own governance model: not testing whether the code did what it was designed to do, but asking whether the design was reasoning about the right thing. In two specific places it wasn’t. Both are now closed, and both are described in public.
Why we publish weaknesses
Every company building AI agent infrastructure says its product is safe. Almost none say where their safety model fell short and what they changed. That asymmetry is backwards: a governance claim that has never survived a hostile read is a marketing claim, and a specific documented fix is far stronger evidence of a working process than another feature bullet.
The engineering detail — what the gaps were, why one of them probably affects most agent permission models shipping today, and the reasoning behind each fix — is written up on the product blog:
Risk isn’t a property of the verb →
How this fits the local-first thesis
MachinaOS runs on your machine. Your code, your files and your audit trail stay there; no execution is brokered through anyone else’s cloud. That is the whole point, and it also makes governance harder rather than easier — there is no central console quietly deciding what an agent may do, so the controls have to travel with the software and survive being handed to someone else.
Which is why the enterprise pieces in 1.1 were deliberately built against public standards — OpenID Connect for identity, CEF, ECS and Splunk HEC for audit export — rather than one customer’s setup. An organisation should be able to point MachinaOS at the identity provider and the SIEM it already owns, and see agent activity arrive alongside everything else its security team watches.
Every enterprise control is opt-in. With nothing configured, the software behaves exactly as it did for a single user on a laptop — that path stays first-class, because it is the one most people actually use.
Where MachinaOS goes next
The architecture decision behind this release was to not rebuild. MachinaOS stays a single coherent local runtime rather than being split into services it has no measured need for. Distribution is a problem to solve when a real deployment demands it, with that deployment’s requirements in hand instead of guesses.
In the meantime the signed desktop build updates itself, the demo runs the current release, and the governance layer does the one job it exists for: making sure that what an AI agent actually does on your machine is something you chose.